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EXAMINER'S AMENDMENT 



An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Kevin Zilka on 6/28/2005. 



Please amend the claims as follows: 
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Amended claims follow: 

1 . (Currently Amended) A computer-implemented method for responding to a virus 
alert, the virus alert containing information pertaining to a new virus, the method 
comprising: 

receiving the virus alert; 

assessing a risk level associated with the new virus, the assessing including: 
obtaining information associated with at least one previous virus which has caused a 
previous infection on a computer system, and comparing the information pertaining to 
the new virus with the information associated with the previous virus which has cause 
the previous infection on the computer system; and 

obtaining a program code based on the risk level; 

wherein the previous virus and the new virus are of a first type, and the 
information associated with the previous virus which has caused the previous infection 
on the computer system includes data associated with a duration of the previous 
infection and a scope of the previous infection. 

2. -4. (Cancelled) 

5. (Previously Presented) The method as recited in claim 1 wherein the information 
associated with the previous virus which has caused the previous infection on the 
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computer system is stored in a profile on a database associated with the computer 
system. 

6. (Original) The method as recited in claim 1 wherein the virus alert is received 
from an anti-virus information source. 

7. (Original) The method as recited in claim 6 wherein the virus alert is 
automatically received from the anti-virus information source. 

8. (Original) The method as recited in claim 7 wherein receiving the virus alert 
includes acquiring the virus alert from the anti-virus information source. 

9. (Original) The method as recited in claim 1 wherein the computer system is a 
computer network, the computer network including a plurality of computing devices. 

10. (Previously Presented) A computer program product responding to a virus alert, 
the virus alert being arranged to provide information pertaining to a new virus, the 
computer program product comprising: 

computer code for receiving the virus alert; 

computer code for assessing a risk level associated with the new virus, the 
assessing including: obtaining information associated with at least one previous virus 
which has caused a previous infection on a computer system, and comparing the 



Application/Control Number: 09/916,969 Page 5 

Art Unit: 2137 

information pertaining to the new virus with the information associated with the previous 
virus which has caused the previous infection on the computer system; 

computer code for obtaining program code based on the risk level; and 
a computer-readable medium that stores the computer codes; 
wherein the previous virus and the new virus are of a first type, and the 
information associated with the previous virus which has caused the previous infection 
on the computer system includes data associated with a duration of the previous 
infection and a scope of the previous infection. 

11. (Cancelled) 

12. (Cancelled) 

13. (Previously Presented) The computer program product as recited in claim 10 
wherein the computer-readable medium is one selected from the group consisting of a 
hard disk, a CD-ROM, a DVD, a computer disk, a tape drive, and a computer memory. 

14. (Previously Presented) A computer system suitable for responding to a virus 
alert, the virus alert being providing information pertaining to a new virus, the computer 
system comprising: 

computer code for receiving the virus alert; 
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computer code for assessing a risk level associated with the new virus, the 
assessing including: obtaining information associated with at least one previous virus 
which has caused a previous infection on the computer system, and comparing the 
information pertaining to the new virus with the information associated with the previous 
virus which has caused the previous infection on the computer system; 

computer code for obtaining code based on the risk level; 

a computer-readable medium that stores the computer codes; and 

a processor that executes the computer codes; 

wherein the previous virus and the new virus are of a first type, and the 
information associated with the previous virus which has caused the previous infection 
on the computer system includes data associated with a duration of the previous 
infection and a scope of the previous infection. 

15.-57. (Cancelled) 

58. (Previously Presented) The computer program product as recited in claim 10 
wherein the information associated with the previous virus which has caused the 
previous infection on the computer system is stored in a profile on a database 
associated with the computer system. 

59. (Previously Presented) The computer program product as recited in claim 10 
wherein the virus alert is received from an anti-virus information source. 
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60. (Previously Presented) The computer program product as recited in claim 59 
wherein the virus alert is automatically received from the anti-virus information source. 

61. (Previously Presented) The computer program product as recited in claim 60 
wherein receiving the virus alert includes acquiring the virus alert from the anti-virus 
information source. 

62. (Previously Presented) The computer program product as recited in claim 10 
wherein the computer system is a computer network, the computer network including a 
plurality of computing devices. 

63. (Cancelled) 

64. (Previously Presented) The computer system as recited in claim 14 wherein the 
information associated with the previous virus which has caused the previous infection 
on the computer system is stored in a profile on a database associated with the 
computer system. 

65. (Previously Presented) The computer system as recited in claim 14 wherein the 
virus alert is received from an anti-virus information source. 



Application/Control Number: 09/916,969 Page 8 

Art Unit: 2137 

66. (Previously Presented) The computer system as recited in claim 65 wherein the 
virus alert is automatically received from the anti-virus information source. 

67. (Previously Presented) The computer system as recited in claim 66 wherein 
receiving the virus alert includes acquiring the virus alert from the anti-virus information 
source. 

68. (Previously Presented) The computer system as recited in claim 14 wherein the 
computer system is a computer network, the computer network including a plurality of 
computing devices. 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jeffrey D. Popham whose telephone number is (571)- 
272-7215. The examiner can normally be reached on M-F 9:00-5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571)-272-3868. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 



Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



872-9306. 




